Suruga-ya: the payment page of "Suruga-ya.JP" was tampered with, and 30,431 card records of about 30,000 customers may have leaked

1. 2025-07-23

   It detected unauthorized access and began investigating and monitoring. A later investigation found that data from the payment page had been sent out from 12:50 that day. [1] [2]

2. 2025-08-04

   Prompted by an outside inquiry, it investigated, detected the tampering of the payment page JavaScript and fixed it the same day. [2]

3. 2025-08-08

   It reported to the Personal Information Protection Commission, consulted the police, suspended card payments and announced the incident. [1] [4]

4. 2025-10-10

   The forensic investigation by an outside expert finished. [2]

5. 2025-12-04

   It published the findings. Intruders had exploited a flaw in a monitoring tool and tampered with the payment page JavaScript. [2] [3]

The card holder name, card number, expiry date, security code and brand of 29,932 customers who paid by card from 12:50 on July 23, 2025 to August 8 are covered, 30,431 card records in all. Name, address, postal code, phone number, email address and the receipt addressee and note may also be included. Apart from the payment page, no trace of the company's other stored personal data being taken has been found. [2] [3]

The company asked card issuers not to charge customers for card reissue. Card payments will stay suspended until countermeasures and outside checks are complete. [2]